From the OWASP Top Ten(s) to the OWASP ASVS
Some people are under the misconception that if they follow the OWASP top 10 that they will have secure applications. But in reality the OWASP Top Ten (and other top ten lists) are just the bare minimum for the sake of entry-level awareness. A more comprehensive understanding of Application Security is needed. This talk with review the OWASP Top Ten 2017 and the OWASP Top Ten Proactive Controls 2018 and compare them to a more comprehensive standard: the OWASP Application Security Verification Standard (ASVS) v3.1. OWASP's ASVS contains over 150 requirements that can provide a basis for testing web application technical security controls and also provide developers with a list of requirements for secure development in a fashion with much more nuance and detail than a top ten list! You cannot base a security program off a Top Ten list. You can base an AppSec program off of the ASVS.
prerequisite attendee experience level: beginner
-
#ToyFailMartin GravråkKristian Løken WilleTuesday Nov 20 @ 10:20
-
Content Security Policies: Let's Break StuffMatt BruntTuesday Nov 20 @ 16:20
-
Putting Your Security on the WireDamien MurphyTuesday Nov 20 @ 15:10
-
Securing APIs and Microservices with OAuth and OpenID ConnectTravis SpencerTuesday Nov 20 @ 11:30
-
From the OWASP Top Ten(s) to the OWASP ASVSPhilippe De RyckTuesday Nov 20 @ 17:30